Initial Fetch integration for Subresource Integrity

Source/modules/fetch/Request.cpp

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "config.h"
 #include "modules/fetch/Request.h"
 
 #include "bindings/core/v8/Dictionary.h"
 #include "core/dom/Document.h"
 #include "core/dom/ExecutionContext.h"
@@ skipping 24 matching lines @@
     if (world.isIsolatedWorld())
         request->setOrigin(world.isolatedWorldSecurityOrigin());
     else
         request->setOrigin(scriptState->executionContext()->securityOrigin());
     // FIXME: Set ForceOriginHeaderFlag.
     request->setSameOriginDataURLFlag(true);
     request->mutableReferrer()->setClient();
     request->setMode(original->mode());
     request->setCredentials(original->credentials());
     request->setRedirect(original->redirect());
+    request->setIntegrity(original->integrity());
     // FIXME: Set cache mode.
     // TODO(yhirano): Set redirect mode.
     return request;
 }
 
 Request* Request::createRequestWithRequestOrString(ScriptState* scriptState, Request* inputRequest, const String& inputString, RequestInit& init, ExceptionState& exceptionState)
 {
     // "1. Let |temporaryBody| be null."
     BodyStreamBuffer* temporaryBody = nullptr;
 
@@ skipping 97 matching lines @@
         if (!inputRequest)
             request->setCredentials(WebURLRequest::FetchCredentialsModeOmit);
     }
 
     // TODO(yhirano): "21. If |init|'s cache member is present, set |request|'s
     // cache mode to it."
 
     // TODO(horo): "22. If |init|'s redirect member is present, set |request|'s
     // redirect mode to it."
 
-    // TODO(jww): "23. If |init|'s integrity member is present, set |request|'s
+    // "If |init|'s integrity member is present, set |request|'s
     // integrity metadata to it."
 

[yhirano, 2015/08/19 10:42:36]

-empty line

[jww, 2015/08/19 16:43:40]

Done.

+    if (!init.integrity.isNull())
+        request->setIntegrity(init.integrity);
+
     // "24. If |init|'s method member is present, let |method| be it and run
     // these substeps:"
     if (!init.method.isNull()) {
         // "1. If |method| is not a method or method is a forbidden method,
         // throw a TypeError."
         if (!isValidHTTPToken(init.method)) {
             exceptionState.throwTypeError("'" + init.method + "' is not a valid HTTP method.");
             return nullptr;
         }
         if (FetchUtils::isForbiddenMethod(init.method)) {
@@ skipping 19 matching lines @@
     // "28. Empty |r|'s request's header list."
     r->m_request->headerList()->clearList();
     // "29. If |r|'s request's mode is no CORS, run these substeps:
     if (r->request()->mode() == WebURLRequest::FetchRequestModeNoCORS) {
         // "1. If |r|'s request's method is not a simple method, throw a
         // TypeError."
         if (!FetchUtils::isSimpleMethod(r->request()->method())) {
             exceptionState.throwTypeError("'" + r->request()->method() + "' is unsupported in no-cors mode.");
             return nullptr;
         }
-        // "Set |r|'s Headers object's guard to |request-no-CORS|.
+        // "2. If |request|'s integrity metadata is not the empty string, throw
+        // a TypeError."
+        if (!request->integrity().isEmpty()) {
+            exceptionState.throwTypeError("The integrity attribute is unsupported in no-cors mode.");
+            return nullptr;
+        }
+        // "3. Set |r|'s Headers object's guard to |request-no-CORS|.
         r->headers()->setGuard(Headers::RequestNoCORSGuard);
     }
     // "30. Fill |r|'s Headers object with |headers|. Rethrow any exceptions."
     if (init.headers) {
         ASSERT(init.headersDictionary.isUndefinedOrNull());
         r->headers()->fillWith(init.headers.get(), exceptionState);
     } else if (!init.headersDictionary.isUndefinedOrNull()) {
         r->headers()->fillWith(init.headersDictionary, exceptionState);
     } else {
         ASSERT(headers);
@@ skipping 257 matching lines @@
         return "follow";
     case WebURLRequest::FetchRedirectModeError:
         return "error";
     case WebURLRequest::FetchRedirectModeManual:
         return "manual";
     }
     ASSERT_NOT_REACHED();
     return "";
 }
 
+String Request::integrity() const
+{
+    return m_request->integrity();
+}
+
 Request* Request::clone(ExceptionState& exceptionState)
 {
     if (bodyUsed()) {
         exceptionState.throwTypeError("Request body is already used");
         return nullptr;
     }
 
     FetchRequestData* request = m_request->clone(executionContext());
     Headers* headers = Headers::create(request->headerList());
     headers->setGuard(m_headers->guard());
@@ skipping 37 matching lines @@
 }
 
 DEFINE_TRACE(Request)
 {
     Body::trace(visitor);
     visitor->trace(m_request);
     visitor->trace(m_headers);
 }
 
 } // namespace blink